CVE-2026-110873: Heym 0.0.55 before 0.0.121 Credential Theft via error_workflow_id Field
Heym from 0.0.55 before 0.0.121 contains a privilege escalation vulnerability that allows shared collaborators to overwrite a workflow's errorworkflowid because the field is missing from OWNERONLYEXECUTIONFIELDS. Attackers can point the error workflow to their own workflow with an HTTP node, and when the parent workflow errors the owner's decrypted credentials are injected and exfiltrated.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Workflows that have shared collaborators are exposed if a collaborator can modify the workflow's error_workflow_id field. The impact occurs when the affected parent workflow runs into an error and has access to the owner's decrypted credentials.
What does an attacker need to exploit it?
An attacker needs shared collaborator access to the target workflow. They must be able to replace its error workflow with a workflow they control that includes an HTTP node, then wait for or cause the parent workflow to error.
Are default deployments affected?
The issue is present in Heym versions from 0.0.55 before 0.0.121. Exploitation additionally depends on shared workflow collaboration and an error workflow configuration that can be overwritten.
What can be done if upgrading is not immediately possible?
Remove or limit shared collaborator access to workflows containing sensitive credentials, and prevent untrusted collaborators from changing error workflow settings. Review error_workflow_id values and remove references to workflows not controlled by the workflow owner.
How can I check for possible compromise?
Review affected workflows for unexpected error_workflow_id changes, especially references to collaborator-owned workflows with HTTP nodes. Investigate workflow error events and outbound HTTP activity from error workflows for possible credential exfiltration.